The solution which is always repeated is to encrypt any sensitive data.

If you need to actually use your data at some point, the cloud provider could snoop the data from your virtual machine's RAM. And they could probably find the decryption key to your data somewhere in memory too if they looked hard enough.

There has actually been research to do data processing on encrypted data. Basically the idea has been to convert data in some other form that has the same properties as the original data for the operations that need to be calculated in the cloud.

Obviously this approach has several limitations but perhaps for most common uses such methods can be found.

The class of computations for which this is possible is fairly worthless. It's not presently possible for anything with actual loops and flow control, and even if it were, timing vulnerabilities would leak tons of information.

That depends on if you're talking about cloud storage or cloud computing.

Encrypting your data is pointless for cloud computing. You're better off asking whether your data is stored in an encrypted file system of some sort. Encrypting your data for putting onto cloud storage is more practical. Yes, the "client" you install may have the ability to root your computer on command, but you might as well unplug the cable going out to the WAN from your home network if you're that afraid of people getting access to

That depends on if you're talking about cloud storage or cloud computing.

Encrypting your data is pointless for cloud computing. You're better off asking whether your data is stored in an encrypted file system of some sort. Encrypting your data for putting onto cloud storage is more practical. Yes, the "client" you install may have the ability to root your computer on command, but you might as well unplug the cable going out to the WAN from your home network if you're that afraid of people getting access to your data.

Encryption is not pointless even in cloud computing. When I encrypt my data, I know that no matter what bugs or faulty procedures the cloud provider may have (i.e. selling old hardware without erasing the hard drives) that exposes my data to a third party, I know that no one can read my sensitive data. It's just another layer of protection.

Cloud providers won't go to these extremes because they are expensive. They are looking for low hanging fruit, not trying to pick apart your life like a CIA target. Besides, people are all too willing to leave things unencrypted, they don't need to bother with the 1% of users who encrypt their data.

Encryption works for the same reason that image sharing sites add watermarks to their photos. A watermark won't stop a determined abuser, but it will stop other sites from doing wholesale copies of all their i

The whole point of cloud computing is the computing part of it. We do not have any practical fully homomorphic encryption system to date. You just can't reasonably perform computation on encrypted data without decrypting it at some stage.

An encrypted filesystem with block striped volumes across multiple different providers would be a pretty good protection. Even if they had your key, they only had a partial block of data which is impossible to reconstruct without all of the blocks.

The solution might also be to have your own cloud instead of using a public cloud. Personal clouds seem to be growing in number over the last year. None are perfect yet, but I've used younity for a while and find that it is far and away my favorite option. The beta has expanded fast and features are added every month or two. The benefit is I have *all* my files accessible via my mobile devices, but no one else has any access to my data (it isn't stored online). And it's free to boot.

back when i was in the army i worked in the command group of a 2 star general. i was in the office down the hall and next to the chief of staff. when they needed computer help i saw their email. it was the most boring crap you can imagine.

If you work for a large or high-profile corporation (or you manage their cloud data), there are people who will pay you good money for a simple list of employees, email addresses, their position and perhaps their pay grade. Won't make you rich but it'll sure be a nice addition to your retirement fund. Enough to tempt some sysadmins with privileged access (as has happened in the past). And I am sure the contents of some mails from the CFO can be put to profitable use.

This has happened at the previous company I worked for, although luckily not at our IT department during my time there.
But during that time there have been several employees from other companies we supported who moved to the competition with data in their pocket.

back when i was in the army i worked in the command group of a 2 star general. i was in the office down the hall and next to the chief of staff. when they needed computer help i saw their email. it was the most boring crap you can imagine.

And that is the secret. How many Slashdotters do you think will go to join the army cybercorps now they know this?

Nobody gives a damn about your data, with good statistical confidence.

OTOH I suspect it is quite important to be able to get your data should the need arise, which is a different concept.That's, at least, what I desume from seemingly grossly inefficient developments in IT, e.g. the cloud where your machines are not part of the nodes, or the UI downloaded from the server, instead of having everything available locally and a remote db for syncing data.

It's a parallel with the development of laws where cronyism replaces democracy. In those system it is not important to put a lot of people in jail, it is vital to make anybody potentially a criminal so you have an excuse to lock people up if the need arises.

Nobody gives a damn about your data, with good statistical confidence.

I wouldn't be so sure about that. There are tens of thousands of small high-tech companies with trade secrets that the "cloud" providers would like to gain as customers. From source code to email and customer data such companies have all kinds of valuable data. The solution is, of course, not to put any of this data into the cloud except in fully encrypted form for georedundant backups.

Wow, no that's simply not true as a broad, blanket statement. I currently work for a company where we have at least one competitor that actively tries to steal our customer lists, with some success (and has lead to successful lawsuits). Attempts have ranged from scraping websites to actually physically stealing backup tapes or paper records.

Now we're in a small enough industry that I very much doubt that information in the cloud would change the risk vector, but these things do happen depending on the ind

While spying/corporate espionage from a cloud supplier is a concern, the bigger concern is the US gov who have proved time and time again that if your data is in their jurisdiction they can look/take all they like and with the provisions in the "patriot" act they don't even need a warrant or tell anybody they looked at it.

say no to the cloud, and moreso if the data or supplier is based in the USA

This.
They might not be able to do it right now (maybe), but you can bet your ass that some department somewhere is working on it. Legally or illegally, they will have access whether you like it or not.

Yes, it's true. They aren't specifically spying on "you". They are spying on EVERYONE. There is a reason why the NSA has direct interconnects with all the major ISPs. They find some group of keywords passing through, trace the connection back to your home, then they go through everything you have "just in case".

It's what happens if you somehow become interesting that matters. Involved in an accident with a powerful official or wealthy person? The ability to examine your supposedly private information for some leverage against you would be useful. Decide to participate in an "Occupy" event? Your dossier will be much easier to fill with easy access to all your "private" information. It's not that hard to come up with realistic scenarios in which an "uninteresting" person could be put at risk by unfettered acces

exactly, as i point out to the people holding out on Facebook accounts due to eavesdropping, first I show that they pretty much are already there, plus I also point out that they are now the short list of people to be spied upon.

The problem with any cloud provider is that you have to trust that their claims about privacy are true without any verifiable evidence that they are in fact true.

Startpage and Duck Duck Go *claim* searches are private, but there is no actual evidence this is true. Believe so at your own peril.

Likewise, Spideroak's claim that they can't even look at your data themselves is comforting, but still just a claim. It may be true and they may believe it to be true (their site is very convincing), but without an a

Its like casinos and poker dealers. Could a morally bankrupt poker room have mechanic dealers working with professional players to cheat people? Sure they could... but they are making so much money playing it straight that it doesn't make sense. If you can pay the dealers an hourly rate and let them keep tips, and make money hand over fist, why risk that in a scheme that requires you to pay them, and some other people, a lot more?

I think this analogy is apt because it shows the real problem isn't the casino

Going to keep the identity kinda vague here but I can say that I'm a high-ish level executive for a company that provides cloud services similar to Amazon and I will tell you first hand that we NEVER ever ever would spy or collect data on our customers. It would be a disaster and far more trouble than it's worth. Most mainstream platforms (VMware, OpenStack, whatever you choose) don't even provide facilities for reading on-disk customer data in a true cloud environment easily; I guess if you really wanted t

What about government access to on-disk data? Given how they are trying to pry into as much as they can these days them having easy access to a "terror suspect's" data wouldn't surprise me. I guess they could just put the Carnivore servers in the ISPs that feed the cloud data centers.

Do I believe Google does? Of course. In fact they're pretty open about a lot of snooping and they try pushing real name policies and other shit to make it easier to shill crap on the web. Why would I not believe they're not snooping on me every single chance they get?